CVE-2026-32034: OpenClaw auth bypass enables

CISO Take

OpenClaw's Control UI contains an authentication bypass that allows any attacker holding low-privilege credentials — obtained via credential dump, phishing, or plaintext HTTP traffic interception — to skip device identity and pairing verification and gain full high-privilege control of the AI agent platform, but only when both `allowInsecureAuth` is explicitly enabled and the gateway is exposed over unencrypted HTTP. For AI agent deployments this compounds a standard web auth bypass: control plane access translates directly into unauthorized manipulation of agent workflows, tool invocations, and configuration, with CWE-78 (OS Command Injection) as the underlying weakness suggesting post-authentication command execution is also within reach. EPSS at the 70th percentile indicates meaningful exploitation probability despite the absence of a public exploit and no CISA KEV listing; the low attack complexity, network-accessible vector, and no-user-interaction requirement mean any organization with this misconfiguration in place is a realistic target. Immediately disable `allowInsecureAuth` in all environments, enforce TLS for every Control UI exposure, rotate credentials that transited over plaintext HTTP, and upgrade to OpenClaw 2026.2.21 or later.

Sources: NVD EPSS GitHub Advisory VulnCheck ATLAS

What is the risk?

CVSS 8.1 High with network-accessible, low-complexity attack vector and no user interaction required. Risk is conditional on two explicit misconfigurations coexisting — `allowInsecureAuth` enabled and plaintext HTTP exposure — but organizations that expose AI agent control planes publicly over HTTP are high-value targets adversaries actively scan for. The AI agent category amplifies traditional auth bypass severity: compromising the control plane enables agent manipulation, not merely data read access. CWE-78 as the weakness class indicates OS-level command injection may be achievable post-bypass, materially elevating the realistic impact beyond the CVSS confidentiality score of None. EPSS 0.38% (top 70th percentile) indicates above-average exploitation probability; 396 other CVEs in the same package signals a historically weak security posture for this dependency.

How does the attack unfold?

Reconnaissance

Adversary scans internet-facing hosts for OpenClaw Control UI instances served over plaintext HTTP, confirming `allowInsecureAuth` is active via login flow fingerprinting or configuration disclosure.

AML.T0006

Credential Acquisition

Attacker obtains low-privilege credentials via a prior credential dump, phishing campaign, or MITM interception of plaintext HTTP traffic to the Control UI.

AML.T0055

Authentication Bypass

Using acquired low-privilege credentials, the attacker exploits the insecure auth path to skip device identity and pairing verification, obtaining a high-privilege Control UI session.

AML.T0012

Agent Manipulation & Impact

With high-privilege access, the adversary modifies agent configurations, redirects tool invocations to attacker-controlled endpoints, or exploits the CWE-78 OS command injection surface to execute arbitrary commands on the host.

AML.T0081

Reconnaissance

Adversary scans internet-facing hosts for OpenClaw Control UI instances served over plaintext HTTP, confirming `allowInsecureAuth` is active via login flow fingerprinting or configuration disclosure.

AML.T0006

Credential Acquisition

Attacker obtains low-privilege credentials via a prior credential dump, phishing campaign, or MITM interception of plaintext HTTP traffic to the Control UI.

AML.T0055

Authentication Bypass

Using acquired low-privilege credentials, the attacker exploits the insecure auth path to skip device identity and pairing verification, obtaining a high-privilege Control UI session.

AML.T0012

Agent Manipulation & Impact

With high-privilege access, the adversary modifies agent configurations, redirects tool invocations to attacker-controlled endpoints, or exploits the CWE-78 OS command injection surface to execute arbitrary commands on the host.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
OpenClaw	pip	—	No patch
4 dependents 37% patched ~3d to patch Full package profile →

Do you use OpenClaw? You're affected.

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

6 steps

Patch: Upgrade to OpenClaw 2026.2.21 or later (patch commit 40a29261).
Immediate workaround: Set allowInsecureAuth: false in configuration and restart the Control UI service — the vulnerability requires this flag to be explicitly enabled.
Enforce TLS: Serve the Control UI gateway exclusively over HTTPS; deploy a reverse proxy (nginx/Caddy) with a valid certificate if TLS termination is not native.
Network segmentation: Restrict Control UI access to trusted internal networks or VPN; block public internet exposure at the firewall level.
Credential rotation: Rotate all Control UI credentials that may have transited over plaintext HTTP sessions, as credentials could have been intercepted.
Detection: Audit Control UI access logs for authenticated sessions from unexpected source IPs or during anomalous hours — since the bypass requires valid credentials, correlation of login events with privilege escalation patterns is the primary detection signal.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent API AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.4 - AI system security

NIST AI RMF

GOVERN 6.1 - Policies, processes, procedures, and practices for AI risk management

OWASP LLM Top 10

LLM08:2023 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-32034?

OpenClaw's Control UI contains an authentication bypass that allows any attacker holding low-privilege credentials — obtained via credential dump, phishing, or plaintext HTTP traffic interception — to skip device identity and pairing verification and gain full high-privilege control of the AI agent platform, but only when both `allowInsecureAuth` is explicitly enabled and the gateway is exposed over unencrypted HTTP. For AI agent deployments this compounds a standard web auth bypass: control plane access translates directly into unauthorized manipulation of agent workflows, tool invocations, and configuration, with CWE-78 (OS Command Injection) as the underlying weakness suggesting post-authentication command execution is also within reach. EPSS at the 70th percentile indicates meaningful exploitation probability despite the absence of a public exploit and no CISA KEV listing; the low attack complexity, network-accessible vector, and no-user-interaction requirement mean any organization with this misconfiguration in place is a realistic target. Immediately disable `allowInsecureAuth` in all environments, enforce TLS for every Control UI exposure, rotate credentials that transited over plaintext HTTP, and upgrade to OpenClaw 2026.2.21 or later.

Is CVE-2026-32034 actively exploited?

No confirmed active exploitation of CVE-2026-32034 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-32034?

1. Patch: Upgrade to OpenClaw 2026.2.21 or later (patch commit 40a29261). 2. Immediate workaround: Set `allowInsecureAuth: false` in configuration and restart the Control UI service — the vulnerability requires this flag to be explicitly enabled. 3. Enforce TLS: Serve the Control UI gateway exclusively over HTTPS; deploy a reverse proxy (nginx/Caddy) with a valid certificate if TLS termination is not native. 4. Network segmentation: Restrict Control UI access to trusted internal networks or VPN; block public internet exposure at the firewall level. 5. Credential rotation: Rotate all Control UI credentials that may have transited over plaintext HTTP sessions, as credentials could have been intercepted. 6. Detection: Audit Control UI access logs for authenticated sessions from unexpected source IPs or during anomalous hours — since the bypass requires valid credentials, correlation of login events with privilege escalation patterns is the primary detection signal.

What systems are affected by CVE-2026-32034?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, AI agent control planes, on-premises AI agent deployments, enterprise AI orchestration pipelines.

What is the CVSS score for CVE-2026-32034?

CVE-2026-32034 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksAI agent control planeson-premises AI agent deploymentsenterprise AI orchestration pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8.4

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM08:2023

What are the technical details?

Original Advisory

OpenClaw versions prior to 2026.2.21 contain an authentication bypass vulnerability in the Control UI when allowInsecureAuth is explicitly enabled and the gateway is exposed over plaintext HTTP, allowing attackers to bypass device identity and pairing verification. An attacker with leaked or intercepted credentials can obtain high-privilege Control UI access by exploiting the lack of secure authentication enforcement over unencrypted HTTP connections.

Exploitation Scenario

An adversary scans internet-facing hosts for OpenClaw Control UI endpoints served over port 80 or other plaintext HTTP ports, identifying instances where the HTTP response headers or body disclose the OpenClaw version or interface. Upon confirming `allowInsecureAuth` is active — detectable from login flow behavior or configuration disclosure — the attacker replays previously-leaked low-privilege credentials (sourced from a credential dump or intercepted via a prior MITM on the same HTTP session). The insecure auth path bypasses device identity and pairing verification, granting a high-privilege session. The attacker then leverages the CWE-78 OS Command Injection surface exposed through the privileged UI to execute arbitrary host commands, establishing a reverse shell or deploying a persistence mechanism within the AI agent orchestration environment. From this position, the attacker can redirect agent tool invocations to attacker-controlled endpoints, poison agent configuration to exfiltrate future data in-band, or disable the agent entirely — all through the agent's own legitimate trust relationships with downstream systems.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.